A white paper written by Didomi and Poool

The future of monetization for publishing has been turned upside down for several years. The advertising-based revenue model, for instance, is undermined for a number of reasons: ad budgets move to GAFAM, disintermediation and loss of margin, adblock and programmed disappearance of third party cookies, difficulty to value your own First-Party Data…

This context is likely to be further disturbed following the latest recommendations from the CNIL (National Commission on Informatics and Liberty), an independent French administrative regulatory body, on the consent of cookies collection. These recommendations are welcomed and logical from a reader’s point of view who wishes to have a real command on their personal data but is likely to have a rather strong impact on consent rates and thus ad revenues for publishers.

Admittedly, publishers have been diversifying their sources of revenue on digital since 2010, notably thanks to the rise of premium models and, more largely, directly generated reader revenue (subscription, donations, micro-payments...). Yet, the proportion of readers ready to pay for information is still minor.

So, how can you monetize an audience, if a large part of it has installed an adblocker, refuses to consent to cookies and does not want to pay to access content?

Until then, there were few options available for publishers. But, during summer 2020, everything changed: the French Council of State caused a breach in the position of the CNIL relative to cookie walls, stating that the French regulatory body did not have to forbid or to discourage them.


Though the idea of a cookie wall can seem interesting and appealing for publishers, a great number of questions remain unresolved:

  • What are the legal implications?
  • How is it perceived by readers?
  • What experience should be offered to make readers stay?
  • What are the first initiatives on the issue?

It is exactly what is at heart in this white paper which follows on from the webinar organized by Didomi and Poool in October 2020 with the kind participation of lawyer Etienne Drouard. You can watch this webinar again here (in French). We have brought out ideas and shed light on complex issues to help publishers in their considerations.

Be aware: the elements or images displayed in this document can not have by any means a legal value. Inquire among your advisors and/or service providers to have a juridical opinion on the subject.

Part 1 - What does the law say on the matter of cookie walls?

Even though the CNIL had decided to discourage cookie walls in 2019, the Council of State went back on this position this summer 2020 considering it did not come under the jurisdiction of the CNIL to forbid this practice. This does turn out to be comforting for the publishing and advertising industry which had been contesting, through representative organizations (Geste, SRI, IAB, Udecam, AACC, Fevad...), the compliance of the decision of the CNIL on cookies and trackers with French and European law.

What is the actual situation in the law and in practice regarding the use of cookie walls? Are they to be favoured or banned? To help you see things more clearly, let's take stock of French and European regulations concerning content access mechanisms, and the concrete solutions available to publishers.

The cookie wall is a mechanism that allows publishers to block access to their websites and applications if cookies are refused. The cookie wall is therefore useful to monetize publications, which is key for the survival of publishers, as it conditions access to a website or application on the acceptance of advertisements. However, its legal status is ambiguous, as it has never been clearly defined, and therefore puts publishers in great legal insecurity.

The European ePrivacy Directive says that the regime of cookies that are not strictly necessary for the delivery of a service is subject to the consent of individuals. And the regime of consent has been clearly defined for 10 years by the GDPR (General Data Protection Regulation) as “any manifestation of free, specific, informed and unequivocal will by which the data subject agrees, by a declaration or by a clear positive act, that personal data relating to them can be processed”.

So, legally, we know what consent is, but we do not yet have a final position on whether the cookie wall prevents freedom of choice which is an essential component of consent. Thus, when the CNIL declared that it was not compliant with the GDPR, it did so without defining what it was.

For lawyer Etienne Drouard, however, it is clear: if at least two options are available to access a service (a cookie wall and something else, such as a paywall or the creation of an account, for example), the cookie wall does not hinder the free consent of users, because an alternative is offered to them.

A practice in line with consumer law

The 2019 EU Directive on consumer protection states that it is legal to ask for compensation in exchange for the supply of a service, and that this compensation can include personal data. We all experience this every time we use a search engine or a social network: the service is free in exchange for the collection of personal data.

The problem is therefore not the collection of data as such, but whether this is done in a transparent manner, with the free consent of the user. Each user must be free to decide what compensation they are prepared to give to a service provider in exchange for access to their service: either they pay, or they register, or they accept cookies which allows publications, via advertising, to monetize the provision of the service.

Believing that everything would be free, without any compensation, is an economic illusion, not a legal requirement.

Probably authorized if there are balanced and fair alternatives

Since the announcement of the public rapporteur, the CNIL has revised its recommendations and finally accepts the principle of cookie walls (article 18 of the deliberation of September 17th, 2020) under certain conditions, assessed on a case-by-case basis.

Legally, we can therefore say that cookie walls are no longer non-compliant with the GDPR, but they are still likely to infringe on the freedom of consent if no alternative is offered, or if the alternative is not balanced (such as an excessive request for money in exchange for the service, for example). Furthermore, the conditions for the use of cookies must be transparent, and the purposes and recipients of the data must be clearly indicated.

In the latest draft of the ePrivacy Regulation, which will provide the clear European legal framework that everyone needs, the door still seems open to cookie walls. It confirms indeed that a cookie wall does not necessarily deprive the user of a free choice; in other words, it does not “twist the user's arm” by forcing them to consent.

“Making access to website content provided without direct monetary payment dependent on the consent of the end-user to the storage and reading of cookies for additional purposes would normally not be considered as depriving the end-user of a genuine choice if the end-user is able to choose between services, on the basis of clear, precise and user-friendly information about the purposes of cookies and similar techniques, between an offer that includes consenting to the use of cookies for additional purposes on the one hand, and an equivalent offer by the same provider that does not involve consenting to data use for additional purposes, on the other hand.” (page 33 of the ePrivacy Draft, Brussels, November 4th, 2020)

In our opinion, publishers can therefore still use cookie walls without fear, as long as they offer clear information and alternatives for accessing their services. Obviously, this does not apply to essential services, such as public services, which everyone should be able to access freely without having to consent to anything.

Part 2 - Cookie wall, which experience for the reader?

The topic of the cookie wall is very recent and complex enough to require a good understanding of the legal implications and issues before considering any user experience. This is the interest of this first part, where we have tried to present you with the state of play and the current legal framework on the subject, a framework that will naturally evolve.

This legal framework allows us to imagine and glimpse what a cookie wall could look like on a publication website. But it is still a little vague and this is rather normal. This is the whole purpose of this second part, which focuses on the concrete, visual aspect of the cookie wall, the possibilities it represents for publications, but also, and above all, the implications and options in terms of user experience.

Naturally, this part should be understood as an essay, as ideas and thoughts on this topic, but by no means as something that has a legal and definitive value. The topic is still too new and uncertain for this to be possible.

Probably the first and most important question is what a cookie wall will look like from the reader's point of view. And what options are available to the reader?

As we have seen in the first part, the very idea of the cookie wall is to offer the user to choose between 2 or more options to access the website, a section of the website, or even an article. Such as for instance:

  • A first option would be to give your consent to some purposes to access all or part of the website, depending on the strategy of the media;
  • A second option could take several forms, such as suggesting a subscription or the creation of an account to the reader.

Nothing is definite at this stage, and other alternatives could be given to the reader, such as paying once or making a donation. Below is an example of a screen where the reader is faced with 2 options: giving consent or subscribing.

At which point can the cookie wall be offered to the reader? On this issue, different options can be considered. Publishers have already adapted the consent screens on their homepage to offer these alternatives (as we will see later). We can therefore think of when these cookie wall banners could be suggested. For example:

  • On the homepage during the first visit;
  • And / or within a content (as what is currently done in the case of a paywall);
  • And / or when accessing a category or section of the website (e.g. archives)

The consent rate is a very important indicator for publications, as it is estimated on average that a user who does not give their consent for advertising purposes yield 50% less on advertising revenues though this data can vary greatly from one publisher to another.

The cookie wall is therefore a tool that could be used to maintain acceptable consent rates, and thus save a part of the monetization linked with advertising. We can therefore suppose that in the coming months it will be used this way by some publications, whatever their type (digital-only publications, “traditional” publications and so on).

Yet for all that, the cookie wall is, from the reader’s point of view, only one step among many.

From the user’s point of view, the cookie wall is indeed one of the many walls that the user will be confronted with in their journey and their quest to read an article. We can easily picture the following 3 walls for a publisher resorting to a paid model:

  • Step 1 - Consent wall;
  • Step 2 - Cookie wall;
  • Step 3 - Paywall.

So, the cookie wall is one additional step in an already loaded user journey, which as well as having different walls (as explained above), includes other requests (push notifications, suggestion to register to the newsletter...).

As we know, over-solicitation generally does not bring anything good for the reader and therefore does not do any good to the publisher’s aims either. Keeping this in mind allows publishers to raise questions on several levels:

  • How to orchestrate the user’s journey?
  • What is the main aim to be achieved at each of these stages?
  • And which action should be proposed at each stage?

The cookie wall is not a mere opportunity to increase these consent rates, it is above all a great opportunity for publishers to try to create a lasting relationship with their readers. This last opportunity will also help making revenue viable rather than simply seeking to maximize short-term gain.

Other industries such as gaming on mobiles or applications have delved into this topic. We will come back to this point in the next section.

Two examples of cookie walls in the United States : the Washington Post and NPR

The subject of cookie walls may well be gradually opening up in France. Some publishers have already started implementing their own initiatives. Some of these have been in place for a while, whereas others are more recent.

The Washington Post may have been one of the first private media outlets to initiate what is akin to a cookie wall. The idea is rather simple: on a first visit to the Washington Post site, three options are proposed in order to “support quality journalism” :

  • Option n°1 - Free of charge : read a given number of articles per month on the Washington Post site on the condition of giving consent to personalized targeted advertising.
  • Option n°2 - Fee paying : taking out a digital subscription of 60$ per year  giving access to the Washington Post content (site + apps) AND (an important point),  giving consent  to personalized targeted advertising.
  • Option n°3 - Fee paying : taking out a digital subscription of 90$ per year giving access  to unlimited content on the Washington Post (site + apps) , benefiting from ad-free navigation and also no tracking for personalized targeting advertising purposes.

If you wish to access the Washington Post site, these are the only 3 options to choose from. The window on your screen cannot be closed. The only alternative is to leave the site. This initiative is a rather interesting one, as it is the first example of its type, and allows us to take a position regarding the interest and regularity of such an approach.

National Public Radio (NPR)  is an American public service media outlet, which has put in place another type of cookie wall. Again, the main idea is simple: upon a first visit to the NPR.org site, there are two possible options proposed within the frame of “Data Protection Choices” :

  • Option n°1 - Free of charge : accept the cookies and access the NPR content on its traditional site, as for any other media site, using analytic technologies, social media functionality or personalized advertising that rely on cookies.
  • Option n°2 - Free of charge : refuse cookies and still have access to the content, in a much simpler version (plain text), with no interaction or advertising but without  any images or videos.



How do you feel about these examples from a user experience perspective?  The value propositions are clear and the options that are presented to the readers enable them to understand that, in order to navigate on the sites of the Washington Post and NPR, they need to accept a quid pro quo.

The readers have a choice, the choice of having a downgraded version (for NPR) or to leave (for the WP) if no option suits them. From the point of view of user experience, it could be said that the situation has been handled well in order to initiate a dialog with the reader on a sensitive subject : the media needs its readers, directly or indirectly, in order to produce quality information.

What can we conclude about these experiments from a regulatory perspective? Could these banners be suggested by a French publisher? Are they conceivable in Europe.

In our opinion, it is the example of the Washington Post - even if it is praiseworthy - that alone raises objections, on two levels if it were to be implemented in France or in Europe.

  • Firstly, due to its non-compliance with the RGPD and ePrivacy. The first free of charge option effectively offers the user free access to the site of the Washington Post only as a quid pro quo of his or her consent for personalized  targeted advertising. However the readers do not have the possibility of knowing the precise purpose  that they  have consented to, nor with which partners this data is shared
  • Secondly, it does not seem conceivable that  advertising can be integrated in two options presented to a user, the first of which is to accept advertising tracking in order to be eligible for limited access to the site, and the second option, which comes with a fee, which makes the user eligible for full access but for which advertising tracking is accepted. Of course, it is easy to understand that such a proposition (when only 2 options are offered) cannot be envisaged for a cookie wall - if tracking is offered for advertising purposes and a subscription offer, the subscription offer must at least be without advertising tracking - and perhaps with no advertising whatsoever (although this is an issue for another debate).

The Gamestar example (that can be tested by visiting their site https://www.gamestar.de) is much more recent and  come straight  from Germany; The publisher, who is  part of the Webedia group, has set up a cookie wall which allows - on the left - the user to accept cookies in order to access the site free of charge (with no possibility  of refusing) or - on the right - to refuse cookies by becoming a paying member.

Unlike the Washington Post, the Gamestar example is more accomplished as much of information concerning the cookies and tracking can be found on the site, in particular in terms of objectives and responsibilities of managing who has access to the data. . With this cookie wall, the publisher has effectively made it possible to see the list of partners and its objectives.

We feel this initiative is more transparent  than that of the Washington Post (even  though, unlike the WP, some improvements concerning user experience and discussion can be considered). Some frustration may arise from not being able to refuse cookies and tracking in order to access the site without paying. Yet, in this way Gamestar are able to offer a cookie wall with an implementation validated by IAB, which complies with Transparency 1 Consent Framework (TFC).


As you will have understood, cookie walls are a more important issue for media than the mere optimization of consent. It is, first and foremost,  an (additional) opportunity to open up a dialog with the readers on the question of payment.  The issues of payment and open dialog with the reader represent the future of monetization for the media.

Within this framework, and regardless of the revenue model chosen by the publisher, a strong and defined brand and an optimized user experience constitute the base of any sustainable relation and revenue model.

If the cookie wall fits into this framework, then we can imagine they will have a more lasting role .  If the choice is clear and open, then cookie walls can represent a welcomed and popular option for the readers. But it is still early days. Whether from a legal or user experience standpoint, nothing has yet been defined with certainty and everything remains to be done. The cookie wall clearly represents a great potential for experimentation and innovation, and early publishers like NPR, Gamestar and The Washington Post have paved the way.

This vision for the media industry is shared by Didomi and Poool. The subject of cookie walls is at the heart of this vision for both our companies. This is why we have collaborated for the past few weeks, working together towards a first version, a POC (proof of concept) of cookie walls, which will soon be available for publishers. If you share this vision and you are looking for partners to assist you during this important stage, then contact us.